FOLLOW US

On Tuesday, Recorded Future, an international cybersecurity firm reported that RedDelta, a state-sponsored Chinese group, had been hacking the Vatican's computer networks. 

The cyber infiltrations come during the lead-up to scheduled negotiations in September between the Catholic Church and the Chinese Communist Party (CCP) regarding control over the appointment of bishops and the status of churches in China.

The multiple hacks began in May, as the CCP began to crack down on Hong Kong dissidents and gain control of the Catholic Church and other religious groups in China.

The relationship between the Holy See, a group of informal Vatican diplomats based in Hong Kong, and Beijing has been very tense in the lead-up to the September talks and in the wake of pro-democracy protests begun last year Hong Kong. 

The September talks were widely believed to include the Church’s appointments of Catholic bishops in China and the status of Holy See’s Study Mission to China. The Holy See Mission group is better known as the “Underground Church.”

Recorded Future analyzed the hack attacks  

According to Recorded Future, RedDelta hackers targeted members of the Hong Kong Catholic Church in a series of spear-phishing operations traced back to May this year.

The Hill reported that the spear-phishing campaign used tactics mirrored by other Chinese-approved hacking operations. However, new techniques and computer code used in the hacks made it difficult to be 100% certain that RedDelta is the source.

One attack during the campaign was hidden in a fake letter from the Vatican to a Hong Kong chaplain, using a sophisticated replica of a letter from the official stationery of Archbishop Edgar Peña Parra. 

In an interview, a cybersecurity specialist who goes by the name Arkbird told ZDNet he discovered malware samples uploaded on VirusTota, a security website that aggregates antivirus products.

Uploaded as ZIP or RAR files, the files run legitimate programs such as Adobe Reader or Microsoft Word when unpacked, but those apps then load a lure document like the fake communications from Vatican officials.

Arkbird also revealed that the legitimate programs and lure documents sideload malicious DLL files that install malware on the victim’s computer.

The particular technique used is a staple of CCP hacking groups, according to an American malware analyst who also spoke with ZDNet.

The final piece of malware detected was a remote-access Trojan known as PlugX, which gives the attacker control over the victim’s computer. This enables access to the targeted victim’s sensitive data, account credentials, or financial information.

A secret agreement behind the phishing attempt

The Underground Church is loyal to the Catholic Church, not to the Chinese Patriotic Catholic Association (an arm of the CCP). Because of this, the underground church has been experiencing intensifying persecution since the secretive Vatican-China accord was reached in September 2018.